NG has significantly fewer plugins than Classic. The only plugins currently implemented in NG are the Proxy and Manual Request plugins.

+

NG has significantly fewer plugins than Classic. The only plugins currently implemented in NG are the Proxy, Manual Request and WebServices plugins.

Some features of the Proxy plugin remain to be ported:

Some features of the Proxy plugin remain to be ported:

Line 35:

Line 35:

* Search

* Search

−

Porting of the WebServices plugin to NG is in progress.

+

Porting of the WebServices plugin to NG is partially completed. Currently it is sufficient to access the WebGoat web service, but it doesn't support complex types. This functionality could easily be added if desired.

==Porting suggestions==

==Porting suggestions==

Line 52:

Line 52:

==Execution==

==Execution==

−

WebScarab NG is currently only executable via Java WebStart, which is likely to pose a problem for certain folk. Maven does have a fatjar plugin which should be able to construct a single jar with all its dependencies. This needs to be investigated.

+

WebScarab NG is currently only executable via Java WebStart, which is likely to pose a problem for certain folk. An alternate packaging has been created, using the Maven onejar plugin, which packages all the required jars into a subdirectory of the "onejar", and provides a specialised classloader to allow Java to access the contents of those jars.

[[Category:OWASP WebScarab Project]]

[[Category:OWASP WebScarab Project]]

[[Category:OWASP WebScarab NG Project]]

[[Category:OWASP WebScarab NG Project]]

Revision as of 11:56, 25 January 2008

This page is intended to document the differences between WebScarab Classic and WebScarab Next Generation

The objective is to list the major features that one has over the other, with the intent to track the porting of desirable features from Classic to NG.

Framework functionality

NG has no concept of the shared cookie jar, which is used in Classic to allow plugins such as the Spider and Manual Request plugins to use the most current cookies for a particular URL. This could/should be replaced by an Identity module, which can provide the most current identifiers for a particular identity (cookies, Basic auth, etc).

NG does not yet have the Transcoder functionality.

Plugins

NG has significantly fewer plugins than Classic. The only plugins currently implemented in NG are the Proxy, Manual Request and WebServices plugins.

Some features of the Proxy plugin remain to be ported:

Ability to specify regexes for URL's (not) to be intercepted

Ability to specify a regex for conversations that should not be stored

Ability to convert a request from a GET to a POST or multipart POST, and vice versa.

This leaves the following plugins to be implemented:

Spider

Extensions

XSSCRLF

SessionIDAnalysis

Scripting

Fragments

Compare

Search

Porting of the WebServices plugin to NG is partially completed. Currently it is sufficient to access the WebGoat web service, but it doesn't support complex types. This functionality could easily be added if desired.

Porting suggestions

For people interested in contributing to this project by porting one of the above plugins, here are some suggestions:

SessionID analysis

The current session id analysis plugin, while looking cool is actually very misleading. Anyone wanting to implement this feature for NG would be advised to take a look at Michal Zalewski's stompy to see how it can be done better.

Search, Compare

These plugins are very clunky to use. It actually makes a lot more sense to make those features available as part of the primary interface, rather than relegating them to a backwater. Search should provide a simple interface where the operator can type some text and click Go, rather than having to write code.

Spider

This plugin should also identify FORMs in the HTML responses, and identify those that have been submitted by matching them with the parameters of GET requests, or the bodies of POST's, using an intelligent matching algorithm. (Empty parameters in the form may be matched to anything in a GET/POST)

Execution

WebScarab NG is currently only executable via Java WebStart, which is likely to pose a problem for certain folk. An alternate packaging has been created, using the Maven onejar plugin, which packages all the required jars into a subdirectory of the "onejar", and provides a specialised classloader to allow Java to access the contents of those jars.